The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the @runcomfy/cli package from the npm registry, which is the official tool for interacting with the RunComfy service.
[COMMAND_EXECUTION]: The skill makes use of the runcomfy CLI through the Bash tool to execute image processing tasks on the RunComfy platform.
[PROMPT_INJECTION]: The skill has an indirect prompt injection attack surface as it processes data from external image URLs.
Ingestion points: External image URLs and reference style images provided by the user are passed directly to the runcomfy CLI via the --input JSON parameter in SKILL.md.
Boundary markers: While the skill notes that JSON formatting prevents shell-level injection, it does not define specific LLM-level delimiters (e.g., XML tags or clear 'ignore' instructions) to isolate potentially adversarial content within the image metadata or source URLs from the agent's primary instructions.
Capability inventory: The skill allows for command execution via Bash(runcomfy *) and network communication via the underlying CLI tool.
Sanitization: The skill documents a warning about untrusted source images but does not specify automated sanitization or validation logic for the content retrieved from the provided URLs.

image-outpainting